CVE-2024-32096

Cross-Site Request Forgery CSRF vulnerability in DAEV.Tech WP Migration Plugin DB & Files – WP Synchro.This issue affects WP Migration Plugin DB & Files – WP Synchro: from n/a through 1.11.2...

CVE-2024-32096 WordPress WP Synchro plugin <= 1.11.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in DAEV.Tech WP Migration Plugin DB & Files – WP Synchro.This issue affects WP Migration Plugin DB & Files – WP Synchro: from n/a through 1.11.2...

CVE-2024-32096 WordPress WP Synchro plugin <= 1.11.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in DAEV.Tech WP Migration Plugin DB & Files – WP Synchro.This issue affects WP Migration Plugin DB & Files – WP Synchro: from n/a through 1.11.2...

CVE-2024-32096

CVE-2024-32096 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin WP Synchro (WP Synchro) , affecting versions from n/a through 1.11.2 . The connected documents confirm CSRF involvement but do not provide concrete exploit details, affected subcomponents, root caus...

Incorrect Access Control

Apache Kafka is vulnerable to Incorrect Access Control. The vulnerability is due to an error in ACL management during ZK to KRaft mode migration, specifically when an ACL is removed while two or more other ACLs remain associated with the same resource. This condition results in Kafka treating the...

Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode

While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL continues to have tw...

GHSA-79VV-VP32-GPP7 Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode

While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL continues to have tw...

CVE-2024-3054

WPvivid Backup & Migration Plugin for WordPress (≤ version 0.9.99) is affected by a PHAR Deserialization vulnerability due to insufficient validation of tree_node[id] in wpvividstg_get_custom_exclude_path_free. The issue allows an authenticated attacker with admin-level access to cause PHAR-based...

CVE-2024-27309

While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL continues to have tw...

UBUNTU-CVE-2024-27309

While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL continues to have tw...

CVE-2024-27309 Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode

While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL continues to have tw...

CVE-2024-27309

CVE-2024-27309 describes a migration-time vulnerability in Apache Kafka when moving from ZooKeeper mode to KRaft mode. Two preconditions trigger the issue: (1) an ACL is removed, and (2) the resource still has two or more other ACLs after the removal. In that scenario Kafka may treat the resource...

CVE-2024-27309 Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode

While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL continues to have tw...

CVE-2024-27309 Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode

While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL continues to have tw...

PT-2024-23469 · WordPress · Wpvivid Backup & Migration Plugin

Name of the Vulnerable Software and Affected Versions: WPvivid Backup & Migration Plugin for WordPress versions up to, and including, 0.9.99 Description: The issue arises from insufficient path validation on the tree nodenodeid parameter, allowing authenticated attackers with admin-level access a...

PT-2024-21811

Name of the Vulnerable Software and Affected Versions Apache Kafka affected versions not specified Description During the migration of an Apache Kafka cluster from ZooKeeper mode to KRaft mode, ACLs may not be correctly enforced under certain conditions. Two preconditions are required to trigger...

WPvivid Backup & Migration Plugin < 0.9.100 - Admin+ PHAR Deserialization

Description The plugin is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untrusted input at the wpvividstggetcustomexcludepathfree action. This is due to the plugin not providing sufficient path validation on the treenodenodeid parameter. Th...

Apache Kafka 安全漏洞

Apache Kafka is an open source distributed streaming platform from the Apache Foundation in the United States. The platform is capable of acquiring real-time data for building applications that react in real time to changes in the data stream. Apache Kafka suffers from a denial-of-acceptance...

WordPress WP Migration Plugin DB & Files – WP Synchro Plugin <= 1.11.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Migration Plugin DB & Files – WP Synchro Type Plugin Vulnerable versions = 1.11.2 Fixed in 1.11.3 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32096 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 667250807b...

WordPress Backup & Migration < 1.4.8 - Unauthenticated Sensitive Information Exposure

Description The WordPress Backup & Migration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.7 via log files. This makes it possible for unauthenticated attackers to extract sensitive data from log files...